It takes the instant value when it polls it (based on which OID is polled can make a slight difference, on some devices it might be the 1minAvg, 5minAvg and so on especially on Cisco if I remember correctly). So to make it clear, the value is read at the moment the device is polled but the read value can sometimes be an already average value. If it went below the threshold and above again in the 5 min interval won't be considered if the value read is still above the threshold at the moment it's polled.